Daily Threat Briefing
← All briefings

argocd-mcp · BookStack · pac4j / pac4j-oidc

Date: 2026-08-30 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

New disclosures include a critical unauthenticated exposure in argocd-mcp, authentication and authorization weaknesses in enterprise-relevant application frameworks, and a remote-code-execution flaw in BookStack’s ZIP import function. The most urgent operational concern is software that is internet-accessible or used as an identity, deployment, or content-management control plane. No new exploitation or European government advisories were reported in the collected data during the reporting window.

Critical Vulnerabilities

CVE-2026-82456 — argocd-mcp

  • Severity: CVSS 10.0
  • EPSS: 0 — no exploitation probability estimate above zero was provided; this does not exclude future exploitation.
  • Technical detail: argocd-mcp version 0.8.0 binds its HTTP transport to all network interfaces and accepts MCP sessions without caller authentication when ARGOCD_API_TOKEN is configured. A network-reachable attacker may therefore interact with the service without valid credentials. Exposure is particularly significant where the MCP service can reach Argo CD APIs or deployment credentials.
  • Exploitation status: No confirmed exploitation reported in the collected data.
  • Remediation: Upgrade to version 0.9.0 or later. Until patched, bind the service only to a trusted interface, restrict access with network controls, and review Argo CD and MCP logs for unauthorized sessions or deployment activity.

CVE-2026-82450 — BookStack

  • Severity: CVSS 8.7
  • EPSS: Not available.
  • Technical detail: BookStack versions before 26.05.4 contain remote code execution in portable ZIP content imports. An attacker requires a user account with Import Content and Create Books permissions and can upload a PHP polyglot file that may execute in the application environment. Risk increases where content-management permissions are broadly assigned or the application is internet-facing.
  • Exploitation status: No confirmed exploitation reported in the collected data.
  • Remediation: Upgrade to BookStack 26.05.4 or later. Review users and groups holding import permissions, remove unnecessary privileges, and inspect web-server and application logs for suspicious uploads or PHP execution.

CVE-2026-82461 / CVE-2026-82463 — pac4j / pac4j-oidc

  • Severity: CVSS 8.6
  • EPSS: Not available.
  • Technical detail: pac4j-oidc before 6.5.6 fails to properly validate access-token signatures, issuers, audiences, and expiration when processing Keycloak roles, potentially allowing forged tokens with administrative privileges. Related pac4j authorization logic before 6.5.6 reverses profile-type validation and may permit authentication through a weaker client profile. Deployments using pac4j for SSO, OIDC, or role-based authorization are affected.
  • Exploitation status: No confirmed exploitation reported in the collected data.
  • Remediation: Upgrade pac4j and pac4j-oidc to 6.5.6 or later. Review OIDC configuration and token-validation behavior, rotate potentially exposed signing or client credentials, and audit authentication logs for anomalous administrator sessions.

CVE-2026-82473 — KubeEdge CloudCore

  • Severity: CVSS 8.8
  • EPSS: Not available.
  • Technical detail: KubeEdge CloudCore through version 1.23.1 accepts node task-status reports over HTTPS without verifying authentication. An attacker able to reach CloudCore on port 10002 may falsely mark upgrade jobs as successful, interfering with node-management workflows and potentially masking failed or malicious operations. Internet-exposed CloudCore instances warrant priority review.
  • Exploitation status: No confirmed exploitation reported in the collected data.
  • Remediation: Upgrade to the vendor-fixed release when available. Restrict port 10002 to trusted edge nodes and management networks, enforce authentication at the network boundary, and validate upgrade status through independent node telemetry.

CVE-2026-75759 — erlef oidcc

  • Severity: CVSS 7.6
  • EPSS: Not available.
  • Technical detail: oidcc versions 3.2.0-beta.1 through 3.9.0 and affected development revisions improperly verify cryptographic signatures in encrypted ID tokens or JARM responses. An unauthenticated attacker may impersonate an arbitrary user where the vulnerable token-processing path is used. Impact depends on the application’s reliance on oidcc for authentication and token acceptance.
  • Exploitation status: Newly published on 2026-08-30; no confirmed exploitation reported.
  • Remediation: Upgrade to the vendor-fixed release beyond the affected versions. Test token signature, issuer, audience, nonce, and expiry validation, and review authentication events for unexpected account or privilege changes.

ONGOING:

  • CVE-2026-66384 (JFrog Artifactory): Actively exploited; patch and audit repositories, credentials, and Docker caches.
  • CVE-2026-8452 (Citrix NetScaler ADC/Gateway): Actively exploited; verify patching and management-interface restrictions.
  • CVE-2026-63520 (Microsoft SharePoint): Active exploitation and public PoC remain reported; patch and hunt for web shells.
  • CVE-2026-60004 (Gitea): KEV remediation deadline passed; patch immediately and audit Git hook directories.
  • CVE-2019-1068 (Microsoft SQL Server): Actively exploited; complete remediation immediately.
  • CVE-2026-53362 (Linux Kernel): KEV-listed privilege escalation; verify remediation.
  • CVE-2023-49105 (ownCloud): Actively exploited; patch and configure signing keys.
  • CVE-2026-19478 (GitLab): Actively exploited; upgrade to a fixed release.

European Advisories

No new BSI, CERT-EU, or CERT-Bund advisories were reported in the collected data during the last 24 hours.

Previously reported German advisories for vm2, Redis, Dovecot, WatchGuard Firebox OS, cPanel/WHM, Microsoft Windows, and ownCloud have no material update in the supplied data and are not repeated here.

Active Threats and Campaigns

  • PaperCut NG/MF exploitation — ONGOING: The second emergency update and bypass-related escalation were reported yesterday. Continue applying the latest vendor emergency release and review application, web, and authentication logs for unauthorized configuration changes or Java execution.
  • Gitea exploitation — ONGOING: More than 8,300 internet-exposed instances were reported vulnerable yesterday. Prioritize external instances and inspect Git hook directories and administrative activity after patching.
  • Microsoft 365 phishing — ONGOING: NovaCookies and Mirage2FA remain relevant; hunt for session-token theft, anomalous OAuth activity, unfamiliar session origins, and conditional-access changes.
  • Internet-exposed edge systems — ONGOING: Maintain attack-surface monitoring and prioritize exposed appliances and management interfaces.

Security News and Context

  1. Patch or isolate all argocd-mcp deployments, especially services reachable from untrusted networks.
  2. Upgrade BookStack and review import permissions and uploaded-file execution logs.
  3. Update pac4j/pac4j-oidc and validate OIDC token-verification controls.
  4. Restrict KubeEdge CloudCore port 10002 and upgrade affected deployments.
  5. Update oidcc and review authentication events for token-validation anomalies.
  6. Complete emergency remediation for PaperCut and internet-exposed Gitea systems.
  7. Continue remediation of previously reported items: CVE-2026-8452, CVE-2026-63520, CVE-2019-1068, CVE-2026-53362, CVE-2023-49105, CVE-2026-19478, and CVE-2026-66384.